0681d7c0ab8bd0f96051de01db95b58bff8885d235a3d139e95e8ea078b66ccc

General

Target
2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe
Size 59KB
Sample261029-138awsfs8w
SHA256 0681d7c0ab8bd0f96051de01db95b58bff8885d235a3d139e95e8ea078b66ccc
MD5 a198f38f6cc020317f690e2d21dbfcb3
SHA1 c66450c4b867c7e3994ca5c28ecebcd23208b922
SHA512 4b2b66ae9c54740d28e42d0e90ffe91fdf4894b8c9db275bf2ad16197ca2248da9612eedf270b612eb00a2febfd32292c06994e12e3a0aebd317b59f8b39f7a3
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrof4/Clsrnu5WcnfBYRu:Mvw9816vhKQLrof4/QQ2fBOu
TLSH
T19A433A430FDD5CF2FB910175087E8B7986BB59E4C25FBE8BAB50CC584836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/files/0x000f0000000248c3-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00080000000248b4-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00080000000248cb-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00030000000006d3-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 4 IoCs

pid	Process
5904	m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe
4484	m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe
6072	m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe
5992	mD119AC20m34B0r4383xBB08zD767A78C33579.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe	2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe
File created	C:\Windows\m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe	m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe
File created	C:\Windows\m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe	m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe
File created	C:\Windows\mD119AC20m34B0r4383xBB08zD767A78C33579.exe	m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3984	cmd.exe
1200	cmd.exe
5724	cmd.exe
2096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mD119AC20m34B0r4383xBB08zD767A78C33579.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4864	2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	5904	m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe
Token: SeIncBasePriorityPrivilege	4484	m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe
Token: SeIncBasePriorityPrivilege	6072	m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 5904	4864	2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe	92
PID 4864 wrote to memory of 5724	4864	2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe	93
PID 5904 wrote to memory of 4484	5904	m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe	94
PID 5904 wrote to memory of 2096	5904	m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe	95
PID 4484 wrote to memory of 6072	4484	m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe	99
PID 4484 wrote to memory of 3984	4484	m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe	100
PID 6072 wrote to memory of 5992	6072	m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe	101
PID 6072 wrote to memory of 1200	6072	m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_a198f38f6cc020317f690e2d21dbfcb3_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe
  C:\Windows\m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe
    C:\Windows\m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe
      C:\Windows\m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\Windows\mD119AC20m34B0r4383xBB08zD767A78C33579.exe
        
        C:\Windows\mD119AC20m34B0r4383xBB08zD767A78C33579.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5992
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\M53C54~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\M3F7E1~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\M7A139~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe

Path C:\Windows\m3F7E1E44m375Br4bcex917FzEBEBA0E9E29F9.exe
Size 59KB
SHA256 d17ea35cee67e01af5204012b6037f9883fe90b63b1c8cb0da029c4c22dfc142
MD5 1863078df3d09affd84eb6eb7a4569c6
SHA1 dbb5d83bb400c915b56297bb0bd96cab1d54b86e
SHA512 714a29f587658bfe22c415205a0e6f43369b0fd8d16f81cc31fdf34652fdbc49668071a99fde6c3e79dc95a58c4f136961aebaa1df469bb6e4f97297d564d315
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroy4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroy4/QQ2fBOu
TLSH
T145434A430FDD5CF2FB910175087E8B7986BB59E4C25FBECBAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe

Path C:\Windows\m53C540E4m67C1r43dcxA435z5BD69655AFB49.exe
Size 59KB
SHA256 c7930a47b02d2aff4fa45203e874f5e963d587d8d49d343911a6d6a46ab746f8
MD5 0f35d3c820717566cf68a3674113a765
SHA1 befc7dea4df69445884d036797c4d1f541975ed3
SHA512 ed062072c8003ff39d4445860288e8229959c2b73aea99c397b07ea2fc1440c84485b39ae599febec812cc0a98f4267e9d9e0f0f777eae48b3e561ebda50a920
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroM4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroM4/QQ2fBOu
TLSH
T180433A430FDD5CF2FB810175087E8B7986BB59E4C25FBEDBAB50CC584836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe

Path C:\Windows\m7A13906Fm160Fr4453xB11Bz8CCD28BB289B9.exe
Size 59KB
SHA256 89d0a2d543265bf96776d645c689d080f64c797ed35f18f8cd52a3333c85f439
MD5 4d91be078364b6c8f5e91e3ead705b18
SHA1 9c006ff1c31bd903d89c67d90333d0dc3be6feed
SHA512 236443de0566e7b4d577dad1af831c9220981c51baa7b742916fa848df49be3c1f70c34d4a08996bb6bc121807dd4dcedc18cd2528793572eddd462a4866ba88
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroZ4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroZ4/QQ2fBOu
TLSH
T10E433A430FDD5CF2FB810175087E8B7986BB59E4C25FBE8BAB50CC584836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mD119AC20m34B0r4383xBB08zD767A78C33579.exe

Path C:\Windows\mD119AC20m34B0r4383xBB08zD767A78C33579.exe
Size 59KB
SHA256 9d39da457a7227d0066ad0b640bdb0217b7402ba0271d4142da2c591d57e0ade
MD5 e19a14fe35affc242c2928b402a72037
SHA1 e65a858e43b6f2f9a774653c327c2d9a21c09e35
SHA512 fd942821cec96a092a30176c46d88ca2e7773c0a64575708287cbfac4a38c55afa6bc79625f63328066628b79fd43e32ae676677894963366f6e38cdc6ff8996
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrol4/Clsrnu5WcnfBYRu:Mvw9816vhKQLrol4/QQ2fBOu
TLSH
T101433A430FDD5CF2FB810175087E8B7986BB59E4C25FBECBAB50CC584836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads